CVE-2026-11822: 
SQLite vulnerability analysis and mitigation

CVE-2026-11822 is a memory corruption vulnerability in SQLite's FTS5 (Full-Text Search 5) extension affecting all versions before 3.53.2. The flaw allows attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. It was published on June 9, 2026, and assigned a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, VulnCheck).

The vulnerability encompasses two distinct memory corruption flaws in SQLite's FTS5 extension (CWE-122: Heap-based Buffer Overflow). First, an out-of-bounds read can be triggered in fts5LeafSeek() via an attacker-controlled loop bound embedded in malformed FTS5 page data. Second, a heap buffer overflow write occurs in fts5ChunkIterate() through a crafted continuation page that causes an integer underflow. Both flaws are triggered when an FTS5 MATCH query is executed against the malicious database, requiring the victim to open and query the attacker-supplied database file (GitHub Advisory, SQLite Patch 1, SQLite Patch 2).

Successful exploitation can result in process crashes (denial of service), memory exhaustion, or arbitrary code execution within the context of the SQLite process. Any application that opens or queries a crafted SQLite database file with FTS5 enabled is at risk, including desktop applications, mobile apps, and server-side software that processes user-supplied database files. The confidentiality, integrity, and availability of the vulnerable system are all rated High impact under CVSS v4.0, though subsequent system impact is limited to the scope of the SQLite process itself (GitHub Advisory).

As of the time of publication, no public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation (VulnCheck). The EPSS score is approximately 0.013–0.178%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must open and execute an FTS5 MATCH query against a maliciously crafted database file (GitHub Advisory).

1. Craft a malicious SQLite database: Create a SQLite database file with a malformed FTS5 virtual table, embedding crafted FTS5 page data — specifically, a continuation page designed to trigger an integer underflow in fts5ChunkIterate() or an attacker-controlled loop bound to trigger an out-of-bounds read in fts5LeafSeek().
2. Deliver the database to the victim: Distribute the crafted .db file via phishing, a malicious download link, a shared file system, or by embedding it in an application that accepts user-supplied database files.
3. Trigger FTS5 MATCH query: Induce the victim's application (or the victim directly) to open the database and execute an FTS5 MATCH query against the malformed virtual table — this can occur automatically if the application queries FTS5 tables on open.
4. Achieve memory corruption: The malformed page data triggers either the out-of-bounds read in fts5LeafSeek() or the heap buffer overflow write in fts5ChunkIterate(), corrupting heap memory.
5. Achieve objective: Depending on exploit reliability and heap layout, the attacker may achieve a process crash (DoS), memory exhaustion, or arbitrary code execution within the SQLite process context (GitHub Advisory, VulnCheck).

• File System: Unexpected or externally sourced .db or .sqlite files present in application directories or user download folders, particularly those containing FTS5 virtual tables with anomalous page structures.
• Process: Application crashes or abnormal termination of processes that use SQLite with FTS5 enabled, especially following the opening of a new database file; unexpected memory usage spikes in SQLite-linked processes.
• Logs: Application crash logs or core dumps referencing SQLite FTS5 functions such as fts5LeafSeek or fts5ChunkIterate; heap corruption error messages from memory allocators (e.g., glibc malloc corruption errors).
• Network: Unusual downloads of .db or .sqlite files from external or untrusted sources to endpoints running SQLite-dependent applications.

Upgrade SQLite to version 3.53.2 or later, which contains patches for both the fts5LeafSeek() out-of-bounds read and the fts5ChunkIterate() heap buffer overflow (SQLite Release Log). As a workaround, avoid opening or querying SQLite databases from untrusted or unverified sources until the patch is applied. If FTS5 functionality is not required by the application, consider disabling or removing FTS5 support at compile time. SUSE has issued a security update (SUSE-SU-2026:22104-1) for affected distributions (SUSE Advisory).

The vulnerability received coverage from security tracking platforms including VulDB, OSV, and Tenable (Nessus plugins 320835 and 321188), indicating broad scanner adoption shortly after disclosure. SUSE and openSUSE issued security advisories and package updates within days of the CVE publication. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. Social media activity was limited, with automated CVE tracking accounts on Bluesky and Nitter noting the disclosure, but no significant researcher commentary or public debate was observed (SUSE Advisory, Tenable).